GDPR Art. 22
Issuer: Regulation (EU) 2016/679
Date: 25 MAY 2018
Status: IN FORCE in European Union, as of 29 JUL 2026
Right not to be subject to purely automated decisions: the ancestor of the rights-based approach.
Since 25 May 2018, people have the right not to be subject to decisions based solely on automated processing that significantly affect them: the legal ancestor of the AI Act's rights-based approach. GDPR safeguards on automated credit, hiring and profiling decisions apply today, alongside (not instead of) the AI Act.
What it actually requires (3 provisions)
- Right not to be subject to purely automated decisions with legal/significant effect
- Applies already today to AI credit scoring, hiring screens and profiling
- Foundation for the AI Act's fundamental-rights-first philosophy
How its status moved
- ADOPTED27 Apr 2016
- APPLICABLE25 May 2018
- CURRENTIn force alongside the AI Act
Sources (1)
Art. 22 GDPR: GDPR: Automated individual decision-making
The right not to be subject to purely automated decisions: the legal ancestor of the AI Act's rights-based approach.
The rest of the European Union stack
5 more instruments in this jurisdiction, each with its own status, provisions and sources.
- EU AI Act: Regulation (EU) 2024/1689IN FORCEWorld's first horizontal AI law; four-tier risk pyramid; extraterritorial (Art. 2).
- Digital Omnibus on AI: Regulation (EU) 2026/1744IN FORCEDefers high-risk application to 2 Dec 2027 (Annex III) / 2 Aug 2028 (Annex I); adds nudifier/NCII + AI-CSAM bans (2 Dec 2026); SME simplifications; substance of high-risk duties unchanged.
- GPAI rules (Chapter V) + Code of PracticeIN FORCEDocumentation, copyright policy, training-data summary; systemic-risk tier >10²⁵ FLOPs; open-source carve-out; Meta declined to sign; enforcement powers activate 2 Aug 2026 (Implementing Reg. 2026/1755).
- European AI OfficeIN FORCEEU-level GPAI regulator: evaluate models, demand access, sanction; expanded remit under the Omnibus.
- Art. 50 transparency dutiesUPCOMINGChatbot disclosure; machine-readable synthetic-content marking; visible deepfake labels.
Where this sits in the wider picture
- The European Union regime dossier gives the doctrine this instrument belongs to, next to the other two jurisdictions.
- The Framework Explorer, filtered to EU lists every instrument in this jurisdiction in one filterable index.
- The governance simulator shows what these rules do to a real AI system, next to what the other two jurisdictions do to the same one.
- The timeline places this date beside what the other capitals were doing that month.
Knowing the instrument is step one. Complying with it is the job.
The programs teach the work that follows a rule like this one: classification calls, conformity assessment, filings, documentation, and the judgment to defend every decision.
VERIFIED 29 JUL 2026. Every fact on this page is drawn from the sources listed above and dated to the day it was checked. Study aid, not legal advice: the official texts are always authoritative.